Secunia

Description
Some vulnerabilities have been discovered in Polipo, which can be exploited by malicious people to cause a DoS (Denial of Service).

1) A vulnerability is caused due to a signedness error within the "httpClientDiscardBody()" function in client.c. This can be exploited to crash the service by sending HTTP requests with an overly large value in the "Content-Length" header.

2) The "httpParseHeaders()" function in http_parse.c does not properly parse certain "Cache-Control" headers, which can be exploited to crash the service by sending HTTP requests with a specially crafted "Cache-Control" header.

The vulnerabilities are confirmed in version 1.0.4. Other versions may also be affected.

Solution
Filter malicious requests.

Provided and/or discovered by
1) Jeremy Brown
2) Reported in a Debian bug by Stefan Fritsch

Changelog
Further details available in Customer Area

Original Advisory
1) http://www.exploit-db.com/exploits/10338
2) http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=547047

Deep Links
Links available in Customer Area